1. Field of the Invention
This invention relates to the field of information network security, and more particularly relates to a method and apparatus for processing network traffic using security group information.
2. Description of the Related Art
Flexible network access technologies such as wireless, Dynamic Host Configuration Protocol (DHCP), virtual private network (VPN) gateways and the like allow users access to a given protected network from a variety of access or entry points. This is true of all manner of networks, including enterprise networks, service provider networks and the like. At the same time, the security afforded while providing such access is of increasing concern. Technologies based on Remote Authentication Dial-In User Service (RADIUS), Terminal Access Controller Access Control System (TACACS) and other protocols allow a user to be authenticated upon entry to the network.
As is known, communications paths across such networks are conceptually separate (e.g., can be viewed as separate virtual paths), although they may traverse some or all of the same network devices (i.e., physical segments), and so are controlled separately using, for example, access control lists (ACLs). Conventionally, constraints upon access enjoyed by network users are enforced by ACLs, which are used to process packets and so control the network traffic of such users. For scalability and manageability, conventional ACLs require the mapping of a user host address (as the source of the given packet(s); for example, an internet protocol (IP) address) to be relatively static, or the security policy be sufficiently lax to allow all possible addresses possible for the user.
Today's security ACLs suffer from a number of infirmities. These ACLs are conventionally applied to a given interface and contain IP addresses which tie the security policy directly to the network topology. As a result, a change in the network such as repartitioning of sub-nets causes the security policy to be revisited. Moreover, it would appear that ACLs in various parts of the network would need to be updated each time a user authenticated to the network, in order to add rules associated with the source IP address assigned to this user's host, which would be specific to that user. This would cause a huge increase in the number of unique ACLs and dramatically increase the rate at which such rules would have to be updated. Within a given ACL, there also exists the problem of dramatic increases in size resulting from the expression of individual IP addresses, where the number of entries is often the number of source addresses multiplied by the number of destination addresses, multiplied by the number of permissions. Thus, the addition of a single individual IP address can have a significant impact on the size of a substantial number of ACLs.
When a customer changes the network topology, the ACLs must be reexamined. Since such ACLs can quite easily reach several hundred or even several thousand of lines in length, such a reexamination can be non-trivial, to say the least. Due to the complexity of such an ACL, the confidence in the changes that are made is not very high, typically, and the ACLs often require extensive testing by the user before being placed in a production environment. Moreover, because platforms using content-addressable memories (CAMs) to implement ACLs require recompiling of some or all of the ACLs when any change is made, the increases in processing cost can be quite severe, approaching a quadratic in the number of users. These increases in complexity increase the chance of a network outage, a security hole, or both. A single ACL stretches a user's ability to manage their security policy. Placing such ACLs throughout the enterprise network therefore impacts the manageability of today's networks. Given the foregoing, particularly in light of the increasingly flexible access that is required now and will be required in the future, relying on existing ACL-based solutions is difficult.
Compounding this problem is the often belated application of such ACLs, which typically occurs at the network edge on the egress side of the network. Because the ACLs of a sub-net are known to the egress router coupled to that sub-net, application of those ACLs is performed by that egress network device (or more simply egress node (e.g., an egress router)). This results in packets being sent across the core of the network, only to be discarded at the egress node. Thus, the network core is forced to carry a significant amount of traffic unnecessarily.
What is required, then, is a mechanism that allows for the efficient identification of network traffic to a given destination, and does so earlier in a packet's traversal of the network (i.e., before the packet reaches the packet's egress node). Preferably, such an approach should be compatible with existing ACL technology, as well as future ACL technology, thus reducing or eliminating the problem of multiplicative ACL growth. Also preferably, such an approach should allow the network to be easily reconfigured and grow, without incurring a disproportionate administrative burden or consuming inordinately large amounts of network resources. Such an approach should also minimize the amount of unnecessary network traffic.
The use of the same reference symbols in different drawings indicates similar or identical items.